SMS of Death on Android: malicious text can crash phones with no click

A security researcher has published a proof of concept for a recently patched Android vulnerability, dubbed SMS of Death and tracked as CVE-2026-58882, which can knock out cellular service or crash unpatched devices by sending a specially crafted text message. The code was released after Google's fix in the October 2026 security updates.

The issue is a zero-click denial-of-service flaw, a term used when the victim does not need to open anything to be affected. It can interrupt ongoing calls, including emergency calls. Because Android processes the message before it reaches the SMS inbox, the victim sees no sign of what caused the crash.

Where the flaw is and who is protected

According to vulnerability researcher Mark Blah, Google fixed the flaw in the October 2026 security updates for devices running Android 14 through 17. However, the flaw is not listed in Google's October security bulletin, and older devices running Android 12 and 13 remain vulnerable because they did not receive the fix.

The root cause is improper validation of a header size value in Android's WapPushOverSms.decodeWapPdu function. WAP Push is an old type of message used to send content and notifications over the cellular network. To exploit the flaw, the attacker sends a malformed eight-byte WAP Push message to the target phone.

When that value is converted to a 32-bit signed integer without bounds checking, it becomes -2147483648. When trying to allocate memory with that negative value, Android throws an error called NegativeArraySizeException, which crashes the com.android.phone process, responsible for cellular telephony functions.

What happens to the attacked phone

Because the com.android.phone process manages cellular functions, the crash disrupts mobile connectivity and disconnects ongoing calls, including calls to emergency services. The attack can also cause repeated crashes when the carrier tries to resend the malicious messages or when Android tries to process messages already stored on the device.

In testing, the researcher found that sending 20 malicious messages could leave phones stuck in reboot loops. On a device running Android 12, the phone rebooted into recovery mode roughly every 90 seconds, requiring a factory reset to work again.

A GitHub contributor named Sakis found a way to remove the malicious messages using Android Debug Bridge (ADB), a tool that connects the phone to a computer for advanced commands. The process, however, requires more advanced technical knowledge and access to a computer.

How to protect yourself now

Google's fix, titled “Fix remote DoS in decodeWapPdu”, prevents the crashes by handling the exceptions generated while processing the malformed messages. The patch also deletes the malicious messages from the SMS database to prevent repeated crashes.

• Install the latest security update available for your model.
• Restart the device after updating, if the system asks you to.
• On devices running Android 12 and 13, be extra careful, as they did not receive the fix mentioned in this article.

Android security updates are usually installed automatically on supported devices, but rollout depends on the manufacturer and carrier. With a working proof of concept already published, which can send the messages from another Android device, installing the latest updates is the most important step to stay protected.